Hacker News Reader

Comment by jamescun | Hacker News Reader

Would this not be misuse of PII?

You own a particular vehicle registration mark as much as you own a particular phone number, and both can reasonably be used to identify an individual (motor database verus telephone database).

View on HN

Why does BMW even store the license plate? Is the warranty tied to a license plate? And if so, why?

They almost certainly don't, most likely there's some lookup table to find VIN from a license plate. I live in the US but I just looked up my VIN correctly by my license plate on VINcheck.info

Registration # information is public in the UK. You can just scan any vehicle on the road. I don't think ownership info is, but you can get all the detail of the car it belongs to (or is SUPPOSED to belong to).

Ah, this makes sense (not necessarily that this is public information, but why the scanning works)

Your license plate is public. It’s literally on your car for all to see.

It's not the license plate that's PII, it's whether I've paid my warranty or not.

License plate is I guess PII. Something public doesn't stop it to be PII, like IP addresses.

I don't think the plate itself is PII, like "158.32.44.25" isn't PII. Tying that to a person is what's PII.

It should be PII, otherwise I can put cameras all over the city, log license plates, and sell service for you to query.

I think PII according to GDPR is something you can go back to identify a person.

I'm not sure, but I think the times and locations are PII. Maybe the plate is too, though, good question.

> It should be PII, otherwise I can put cameras all over the city, log license plates, and sell service for you to query.

This exists and it’s a very profitable business:

https://www.engadget.com/2019-09-17-repo-drivers-scan-licens...

I think it’s about $20 per query to track a known plate.

A personal IP address is PII. The same for a license plate. At least under GDPR.

In the UK private companies are allowed to scan licence plates though, literally every single supermarket car park has AMPR cameras which record when you shop there. There's usually a plaque somewhere that says "by entering this carpark you allow us to use information about you".

In Europe/UK an IP is PII. This link explains it: https://ico.org.uk/for-organisations/guide-to-data-protectio...

Oh nice, that's good to know, thanks!

Having a warranty is boolean, so can't be personally identifying (though it is personal private information). The license plate is unique to your car, so is personally identifying. Edit: the key term is that it's indirectly identifying: https://gdpr.eu/eu-gdpr-personal-data/

Being "called John Smith, living at 12 High Street and having an interest in titty bars" is a boolean too. I'm not sure I'd want that to leak out though, ..., aw crap.

Boolean means there are only two possible values, so the name and address mean that isn't boolean. Only the last bit is, by itself.

I was trying to demonstrate that any information can be trivially encoded as booleans -- "my name is John Smilh", "My name is John Brown", ... and so on gives a series of boolean valued statements, and if you know the answer to all of them, then you know the name of the subject. Booleaness is no barrier to information leakage.

But BMW provides the warranty - so they know whether they, as in - BMW UK - cover a car with this licence plate or not. They don't need any information about you at all, they have the information they need on their side - so they definitely don't need to ask anyone for permission to access it.

I don't think that's the issue here.

The issue is them broadcasting in a Billboard that a BMW nearby doesn't have warranty.

Depends what the bilboard says. If it says "Hey, BMW EG16WHJ - your warranty is expired!" then yeah, that's probably not ok. But if they detect that a BMW with an expired warranty is stopped near the bilboard and just say "hey, is your BMW warranty expired? Renew today!" then it would be very hard to make an argument against it.

Your warranty status with the original manufacturer is not.

I don't understand why you think that's relevant to whether it's personal data or not.

Here's what the UK DVL say: https://www.whatdotheyknow.com/request/286454/response/69598...

https://www.whatdotheyknow.com/request/286454/response/69598...

My warranty status is not public.

It is PII under GDPR for sure.

It sure is if an IP address (with on average probably a shorter lease than a BMW) is considered PII too

UK is no longer under the GDPR right?

About one week left.

The UK has left the EU however the Data Protection Act 2018 which implemented GDPR within the UK is still in effect.

It is until the end of the 2020 transition period. Thereafter it is not, but the Government intends to introduce similar privacy legislation.

> The Data Protection Act 2018 (DPA 2018), which currently supplements and tailors the GDPR within the UK, will continue to apply.

> The provisions of the GDPR will be incorporated directly into UK law from the end of the transition period, to sit alongside the DPA 2018.

https://ico.org.uk/for-organisations/data-protection-at-the-...

I know it’s bad form to ask, but I’m curious why this is being downvoted. It’s factually correct so far as I can tell.

It's because Hacker News is very anti-privacy, unless it's their own data.

You should only be allowed to control your own PII if you can afford a $1000 Apple product. Everyone else is fair game.

I guess it's the "government intends to" given how close to the end of the year is

Of course everything regarding the EU exist is a total mess, now, with just 7 days, 9 hours left - including Christmas Day and Boxing Day - so just 2 working days left - we've been told that there is a new trade deal with the EU, which may or may not be passed into law this year on both the EU and the UK side.

I believe that the appropiate laws and instruments are already in place to roll over GDPR into next year

You probably waived through all of that on GDPR consent page of your BMW app.

Following GDPR it should be possible possible for users to revoke a given consent.

It is possible to delete application data under Privacy and Terms tab, but I see nothing about revoking consent (I have the app).

They probably would if you write them.

Reply on news.ycombinator.com